potatolondon/djangae-scaffold — pull request #10 by adamalton (2014-11-11 21:20:20+00:00)
Title: Django admin setup

This sets things up so that by default we're only using the gauth auth backend (not Django's username/password one), and the Django admin is doubly locked down with `login: admin` as well as the `is_staff` check which Django does.

I considered changing the login page which the admin site shows so that it doesn't show the password screen, but the only ways I could think of doing it were:

* Adding a 'templates' directory and overriding the relevant template. But this would only be a visual change and wouldn't actually prevent POST submissions.
* Some kind of monkey patch or middleware to prevent those POST requests.

Both of those seem a bit hacky, and given that neither of them would actually have *any* effect at all because:

1. The auth backend doesn't accept username/password credentials anyway.
2. The whole thing is already locked down to `login: admin` so non-app-admins won't even be able to see the login screen anyway.

So I decided that it would be pointless.